pulumi-gcp 8.32.0__py3-none-any.whl → 8.32.0a1747459264__py3-none-any.whl

pulumi_gcp/iam/workload_identity_pool.py

@@ -14,8 +14,6 @@ if sys.version_info >= (3, 11):
 else:
     from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
-from . import outputs
-from ._inputs import *
 
 __all__ = ['WorkloadIdentityPoolArgs', 'WorkloadIdentityPool']
 
@@ -26,9 +24,6 @@ class WorkloadIdentityPoolArgs:
                  description: Optional[pulumi.Input[builtins.str]] = None,
                  disabled: Optional[pulumi.Input[builtins.bool]] = None,
                  display_name: Optional[pulumi.Input[builtins.str]] = None,
-                 inline_certificate_issuance_config: Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']] = None,
-                 inline_trust_config: Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']] = None,
-                 mode: Optional[pulumi.Input[builtins.str]] = None,
                  project: Optional[pulumi.Input[builtins.str]] = None):
         """
         The set of arguments for constructing a WorkloadIdentityPool resource.
@@ -43,34 +38,6 @@ class WorkloadIdentityPoolArgs:
                existing tokens to access resources. If the pool is re-enabled, existing tokens grant
                access again.
         :param pulumi.Input[builtins.str] display_name: A display name for the pool. Cannot exceed 32 characters.
-        :param pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs'] inline_certificate_issuance_config: Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-               within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-               required for issuance and rotation of mTLS workload certificates.
-               Structure is documented below.
-        :param pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs'] inline_trust_config: Represents config to add additional trusted trust domains. Defines configuration for extending
-               trust to additional trust domains. By establishing trust with another domain, the current
-               domain will recognize and accept certificates issued by entities within the trusted domains.
-               Note that a trust domain automatically trusts itself, eliminating the need for explicit
-               configuration.
-               Structure is documented below.
-        :param pulumi.Input[builtins.str] mode: The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-               are in `FEDERATION_ONLY` mode.
-               
-               > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-               `pulumi preview` may show an update if you change this field's value, `pulumi up`
-               **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-               To specify a different `mode`, please create a new Workload Identity Pool resource.
-               * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-               Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-               workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-               within the pool besides providers.
-               * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-               identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-               workload identifier. The subject identifier for all identities must conform to the following
-               format: `ns/<namespace>/sa/<workload_identifier>`.
-               `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-               mode pools.
-               Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
         :param pulumi.Input[builtins.str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
         """
@@ -81,12 +48,6 @@ class WorkloadIdentityPoolArgs:
             pulumi.set(__self__, "disabled", disabled)
         if display_name is not None:
             pulumi.set(__self__, "display_name", display_name)
-        if inline_certificate_issuance_config is not None:
-            pulumi.set(__self__, "inline_certificate_issuance_config", inline_certificate_issuance_config)
-        if inline_trust_config is not None:
-            pulumi.set(__self__, "inline_trust_config", inline_trust_config)
-        if mode is not None:
-            pulumi.set(__self__, "mode", mode)
         if project is not None:
             pulumi.set(__self__, "project", project)
 
@@ -145,67 +106,6 @@ class WorkloadIdentityPoolArgs:
     def display_name(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "display_name", value)
 
-    @property
-    @pulumi.getter(name="inlineCertificateIssuanceConfig")
-    def inline_certificate_issuance_config(self) -> Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']]:
-        """
-        Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-        within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-        required for issuance and rotation of mTLS workload certificates.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_certificate_issuance_config")
-
-    @inline_certificate_issuance_config.setter
-    def inline_certificate_issuance_config(self, value: Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']]):
-        pulumi.set(self, "inline_certificate_issuance_config", value)
-
-    @property
-    @pulumi.getter(name="inlineTrustConfig")
-    def inline_trust_config(self) -> Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']]:
-        """
-        Represents config to add additional trusted trust domains. Defines configuration for extending
-        trust to additional trust domains. By establishing trust with another domain, the current
-        domain will recognize and accept certificates issued by entities within the trusted domains.
-        Note that a trust domain automatically trusts itself, eliminating the need for explicit
-        configuration.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_trust_config")
-
-    @inline_trust_config.setter
-    def inline_trust_config(self, value: Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']]):
-        pulumi.set(self, "inline_trust_config", value)
-
-    @property
-    @pulumi.getter
-    def mode(self) -> Optional[pulumi.Input[builtins.str]]:
-        """
-        The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-        are in `FEDERATION_ONLY` mode.
-
-        > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-        `pulumi preview` may show an update if you change this field's value, `pulumi up`
-        **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-        To specify a different `mode`, please create a new Workload Identity Pool resource.
-        * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-        Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-        workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-        within the pool besides providers.
-        * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-        identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-        workload identifier. The subject identifier for all identities must conform to the following
-        format: `ns/<namespace>/sa/<workload_identifier>`.
-        `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-        mode pools.
-        Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
-        """
-        return pulumi.get(self, "mode")
-
-    @mode.setter
-    def mode(self, value: Optional[pulumi.Input[builtins.str]]):
-        pulumi.set(self, "mode", value)
-
     @property
     @pulumi.getter
     def project(self) -> Optional[pulumi.Input[builtins.str]]:
@@ -226,9 +126,6 @@ class _WorkloadIdentityPoolState:
                  description: Optional[pulumi.Input[builtins.str]] = None,
                  disabled: Optional[pulumi.Input[builtins.bool]] = None,
                  display_name: Optional[pulumi.Input[builtins.str]] = None,
-                 inline_certificate_issuance_config: Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']] = None,
-                 inline_trust_config: Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']] = None,
-                 mode: Optional[pulumi.Input[builtins.str]] = None,
                  name: Optional[pulumi.Input[builtins.str]] = None,
                  project: Optional[pulumi.Input[builtins.str]] = None,
                  state: Optional[pulumi.Input[builtins.str]] = None,
@@ -240,44 +137,16 @@ class _WorkloadIdentityPoolState:
                existing tokens to access resources. If the pool is re-enabled, existing tokens grant
                access again.
         :param pulumi.Input[builtins.str] display_name: A display name for the pool. Cannot exceed 32 characters.
-        :param pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs'] inline_certificate_issuance_config: Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-               within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-               required for issuance and rotation of mTLS workload certificates.
-               Structure is documented below.
-        :param pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs'] inline_trust_config: Represents config to add additional trusted trust domains. Defines configuration for extending
-               trust to additional trust domains. By establishing trust with another domain, the current
-               domain will recognize and accept certificates issued by entities within the trusted domains.
-               Note that a trust domain automatically trusts itself, eliminating the need for explicit
-               configuration.
-               Structure is documented below.
-        :param pulumi.Input[builtins.str] mode: The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-               are in `FEDERATION_ONLY` mode.
-               
-               > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-               `pulumi preview` may show an update if you change this field's value, `pulumi up`
-               **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-               To specify a different `mode`, please create a new Workload Identity Pool resource.
-               * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-               Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-               workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-               within the pool besides providers.
-               * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-               identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-               workload identifier. The subject identifier for all identities must conform to the following
-               format: `ns/<namespace>/sa/<workload_identifier>`.
-               `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-               mode pools.
-               Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
         :param pulumi.Input[builtins.str] name: The resource name of the pool as
                `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}`.
         :param pulumi.Input[builtins.str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
         :param pulumi.Input[builtins.str] state: The state of the pool.
-               * `STATE_UNSPECIFIED`: State unspecified.
-               * `ACTIVE`: The pool is active, and may be used in Google Cloud policies.
-               * `DELETED`: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
+               * STATE_UNSPECIFIED: State unspecified.
+               * ACTIVE: The pool is active, and may be used in Google Cloud policies.
+               * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
                approximately 30 days. You can restore a soft-deleted pool using
-               `UndeleteWorkloadIdentityPool`. You cannot reuse the ID of a soft-deleted pool until it is
+               UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
                permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
                use existing tokens to access resources. If the pool is undeleted, existing tokens grant
                access again.
@@ -294,12 +163,6 @@ class _WorkloadIdentityPoolState:
             pulumi.set(__self__, "disabled", disabled)
         if display_name is not None:
             pulumi.set(__self__, "display_name", display_name)
-        if inline_certificate_issuance_config is not None:
-            pulumi.set(__self__, "inline_certificate_issuance_config", inline_certificate_issuance_config)
-        if inline_trust_config is not None:
-            pulumi.set(__self__, "inline_trust_config", inline_trust_config)
-        if mode is not None:
-            pulumi.set(__self__, "mode", mode)
         if name is not None:
             pulumi.set(__self__, "name", name)
         if project is not None:
@@ -347,67 +210,6 @@ class _WorkloadIdentityPoolState:
     def display_name(self, value: Optional[pulumi.Input[builtins.str]]):
         pulumi.set(self, "display_name", value)
 
-    @property
-    @pulumi.getter(name="inlineCertificateIssuanceConfig")
-    def inline_certificate_issuance_config(self) -> Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']]:
-        """
-        Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-        within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-        required for issuance and rotation of mTLS workload certificates.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_certificate_issuance_config")
-
-    @inline_certificate_issuance_config.setter
-    def inline_certificate_issuance_config(self, value: Optional[pulumi.Input['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs']]):
-        pulumi.set(self, "inline_certificate_issuance_config", value)
-
-    @property
-    @pulumi.getter(name="inlineTrustConfig")
-    def inline_trust_config(self) -> Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']]:
-        """
-        Represents config to add additional trusted trust domains. Defines configuration for extending
-        trust to additional trust domains. By establishing trust with another domain, the current
-        domain will recognize and accept certificates issued by entities within the trusted domains.
-        Note that a trust domain automatically trusts itself, eliminating the need for explicit
-        configuration.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_trust_config")
-
-    @inline_trust_config.setter
-    def inline_trust_config(self, value: Optional[pulumi.Input['WorkloadIdentityPoolInlineTrustConfigArgs']]):
-        pulumi.set(self, "inline_trust_config", value)
-
-    @property
-    @pulumi.getter
-    def mode(self) -> Optional[pulumi.Input[builtins.str]]:
-        """
-        The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-        are in `FEDERATION_ONLY` mode.
-
-        > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-        `pulumi preview` may show an update if you change this field's value, `pulumi up`
-        **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-        To specify a different `mode`, please create a new Workload Identity Pool resource.
-        * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-        Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-        workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-        within the pool besides providers.
-        * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-        identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-        workload identifier. The subject identifier for all identities must conform to the following
-        format: `ns/<namespace>/sa/<workload_identifier>`.
-        `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-        mode pools.
-        Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
-        """
-        return pulumi.get(self, "mode")
-
-    @mode.setter
-    def mode(self, value: Optional[pulumi.Input[builtins.str]]):
-        pulumi.set(self, "mode", value)
-
     @property
     @pulumi.getter
     def name(self) -> Optional[pulumi.Input[builtins.str]]:
@@ -439,11 +241,11 @@ class _WorkloadIdentityPoolState:
     def state(self) -> Optional[pulumi.Input[builtins.str]]:
         """
         The state of the pool.
-        * `STATE_UNSPECIFIED`: State unspecified.
-        * `ACTIVE`: The pool is active, and may be used in Google Cloud policies.
-        * `DELETED`: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
+        * STATE_UNSPECIFIED: State unspecified.
+        * ACTIVE: The pool is active, and may be used in Google Cloud policies.
+        * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
         approximately 30 days. You can restore a soft-deleted pool using
-        `UndeleteWorkloadIdentityPool`. You cannot reuse the ID of a soft-deleted pool until it is
+        UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
         permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
         use existing tokens to access resources. If the pool is undeleted, existing tokens grant
         access again.
@@ -481,9 +283,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
                  description: Optional[pulumi.Input[builtins.str]] = None,
                  disabled: Optional[pulumi.Input[builtins.bool]] = None,
                  display_name: Optional[pulumi.Input[builtins.str]] = None,
-                 inline_certificate_issuance_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs', 'WorkloadIdentityPoolInlineCertificateIssuanceConfigArgsDict']]] = None,
-                 inline_trust_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineTrustConfigArgs', 'WorkloadIdentityPoolInlineTrustConfigArgsDict']]] = None,
-                 mode: Optional[pulumi.Input[builtins.str]] = None,
                  project: Optional[pulumi.Input[builtins.str]] = None,
                  workload_identity_pool_id: Optional[pulumi.Input[builtins.str]] = None,
                  __props__=None):
@@ -495,8 +294,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools)
         * How-to Guides
-            * [Configure managed workload identity authentication for Compute Engine](https://cloud.google.com/iam/docs/create-managed-workload-identities)
-            * [Configure managed workload identity authentication for GKE](https://cloud.google.com/iam/docs/create-managed-workload-identities-gke)
             * [Managing workload identity pools](https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers#pools)
 
         ## Example Usage
@@ -509,7 +306,7 @@ class WorkloadIdentityPool(pulumi.CustomResource):
 
         example = gcp.iam.WorkloadIdentityPool("example", workload_identity_pool_id="example-pool")
         ```
-        ### Iam Workload Identity Pool Full Federation Only Mode
+        ### Iam Workload Identity Pool Full
 
         ```python
         import pulumi
@@ -517,59 +314,9 @@ class WorkloadIdentityPool(pulumi.CustomResource):
 
         example = gcp.iam.WorkloadIdentityPool("example",
             workload_identity_pool_id="example-pool",
-            display_name="Name of the pool",
-            description="Identity pool operates in FEDERATION_ONLY mode",
-            disabled=True,
-            mode="FEDERATION_ONLY")
-        ```
-        ### Iam Workload Identity Pool Full Trust Domain Mode
-
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-        import pulumi_std as std
-
-        example = gcp.iam.WorkloadIdentityPool("example",
-            workload_identity_pool_id="example-pool",
-            display_name="Name of the pool",
-            description="Identity pool operates in TRUST_DOMAIN mode",
-            disabled=True,
-            mode="TRUST_DOMAIN",
-            inline_certificate_issuance_config={
-                "ca_pools": {
-                    "us-central1": "projects/project-bar/locations/us-central1/caPools/ca-pool-bar",
-                    "asia-east2": "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo",
-                },
-                "lifetime": "86400s",
-                "rotation_window_percentage": 50,
-                "key_algorithm": "ECDSA_P256",
-            },
-            inline_trust_config={
-                "additional_trust_bundles": [
-                    {
-                        "trust_domain": "example.com",
-                        "trust_anchors": [
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_1.pem").result,
-                            },
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_2.pem").result,
-                            },
-                        ],
-                    },
-                    {
-                        "trust_domain": "example.net",
-                        "trust_anchors": [
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_3.pem").result,
-                            },
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_4.pem").result,
-                            },
-                        ],
-                    },
-                ],
-            })
+            display_name="Name of pool",
+            description="Identity pool for automated test",
+            disabled=True)
         ```
 
         ## Import
@@ -603,34 +350,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
                existing tokens to access resources. If the pool is re-enabled, existing tokens grant
                access again.
         :param pulumi.Input[builtins.str] display_name: A display name for the pool. Cannot exceed 32 characters.
-        :param pulumi.Input[Union['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs', 'WorkloadIdentityPoolInlineCertificateIssuanceConfigArgsDict']] inline_certificate_issuance_config: Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-               within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-               required for issuance and rotation of mTLS workload certificates.
-               Structure is documented below.
-        :param pulumi.Input[Union['WorkloadIdentityPoolInlineTrustConfigArgs', 'WorkloadIdentityPoolInlineTrustConfigArgsDict']] inline_trust_config: Represents config to add additional trusted trust domains. Defines configuration for extending
-               trust to additional trust domains. By establishing trust with another domain, the current
-               domain will recognize and accept certificates issued by entities within the trusted domains.
-               Note that a trust domain automatically trusts itself, eliminating the need for explicit
-               configuration.
-               Structure is documented below.
-        :param pulumi.Input[builtins.str] mode: The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-               are in `FEDERATION_ONLY` mode.
-               
-               > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-               `pulumi preview` may show an update if you change this field's value, `pulumi up`
-               **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-               To specify a different `mode`, please create a new Workload Identity Pool resource.
-               * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-               Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-               workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-               within the pool besides providers.
-               * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-               identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-               workload identifier. The subject identifier for all identities must conform to the following
-               format: `ns/<namespace>/sa/<workload_identifier>`.
-               `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-               mode pools.
-               Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
         :param pulumi.Input[builtins.str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
         :param pulumi.Input[builtins.str] workload_identity_pool_id: The ID to use for the pool, which becomes the final component of the resource name. This
@@ -654,8 +373,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
 
         * [API documentation](https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools)
         * How-to Guides
-            * [Configure managed workload identity authentication for Compute Engine](https://cloud.google.com/iam/docs/create-managed-workload-identities)
-            * [Configure managed workload identity authentication for GKE](https://cloud.google.com/iam/docs/create-managed-workload-identities-gke)
             * [Managing workload identity pools](https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers#pools)
 
         ## Example Usage
@@ -668,67 +385,17 @@ class WorkloadIdentityPool(pulumi.CustomResource):
 
         example = gcp.iam.WorkloadIdentityPool("example", workload_identity_pool_id="example-pool")
         ```
-        ### Iam Workload Identity Pool Full Federation Only Mode
-
-        ```python
-        import pulumi
-        import pulumi_gcp as gcp
-
-        example = gcp.iam.WorkloadIdentityPool("example",
-            workload_identity_pool_id="example-pool",
-            display_name="Name of the pool",
-            description="Identity pool operates in FEDERATION_ONLY mode",
-            disabled=True,
-            mode="FEDERATION_ONLY")
-        ```
-        ### Iam Workload Identity Pool Full Trust Domain Mode
+        ### Iam Workload Identity Pool Full
 
         ```python
         import pulumi
         import pulumi_gcp as gcp
-        import pulumi_std as std
 
         example = gcp.iam.WorkloadIdentityPool("example",
             workload_identity_pool_id="example-pool",
-            display_name="Name of the pool",
-            description="Identity pool operates in TRUST_DOMAIN mode",
-            disabled=True,
-            mode="TRUST_DOMAIN",
-            inline_certificate_issuance_config={
-                "ca_pools": {
-                    "us-central1": "projects/project-bar/locations/us-central1/caPools/ca-pool-bar",
-                    "asia-east2": "projects/project-foo/locations/asia-east2/caPools/ca-pool-foo",
-                },
-                "lifetime": "86400s",
-                "rotation_window_percentage": 50,
-                "key_algorithm": "ECDSA_P256",
-            },
-            inline_trust_config={
-                "additional_trust_bundles": [
-                    {
-                        "trust_domain": "example.com",
-                        "trust_anchors": [
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_1.pem").result,
-                            },
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_2.pem").result,
-                            },
-                        ],
-                    },
-                    {
-                        "trust_domain": "example.net",
-                        "trust_anchors": [
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_3.pem").result,
-                            },
-                            {
-                                "pem_certificate": std.file(input="test-fixtures/trust_anchor_4.pem").result,
-                            },
-                        ],
-                    },
-                ],
-            })
+            display_name="Name of pool",
+            description="Identity pool for automated test",
+            disabled=True)
         ```
 
         ## Import
@@ -773,9 +440,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
                  description: Optional[pulumi.Input[builtins.str]] = None,
                  disabled: Optional[pulumi.Input[builtins.bool]] = None,
                  display_name: Optional[pulumi.Input[builtins.str]] = None,
-                 inline_certificate_issuance_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs', 'WorkloadIdentityPoolInlineCertificateIssuanceConfigArgsDict']]] = None,
-                 inline_trust_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineTrustConfigArgs', 'WorkloadIdentityPoolInlineTrustConfigArgsDict']]] = None,
-                 mode: Optional[pulumi.Input[builtins.str]] = None,
                  project: Optional[pulumi.Input[builtins.str]] = None,
                  workload_identity_pool_id: Optional[pulumi.Input[builtins.str]] = None,
                  __props__=None):
@@ -790,9 +454,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
             __props__.__dict__["description"] = description
             __props__.__dict__["disabled"] = disabled
             __props__.__dict__["display_name"] = display_name
-            __props__.__dict__["inline_certificate_issuance_config"] = inline_certificate_issuance_config
-            __props__.__dict__["inline_trust_config"] = inline_trust_config
-            __props__.__dict__["mode"] = mode
             __props__.__dict__["project"] = project
             if workload_identity_pool_id is None and not opts.urn:
                 raise TypeError("Missing required property 'workload_identity_pool_id'")
@@ -812,9 +473,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
             description: Optional[pulumi.Input[builtins.str]] = None,
             disabled: Optional[pulumi.Input[builtins.bool]] = None,
             display_name: Optional[pulumi.Input[builtins.str]] = None,
-            inline_certificate_issuance_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs', 'WorkloadIdentityPoolInlineCertificateIssuanceConfigArgsDict']]] = None,
-            inline_trust_config: Optional[pulumi.Input[Union['WorkloadIdentityPoolInlineTrustConfigArgs', 'WorkloadIdentityPoolInlineTrustConfigArgsDict']]] = None,
-            mode: Optional[pulumi.Input[builtins.str]] = None,
             name: Optional[pulumi.Input[builtins.str]] = None,
             project: Optional[pulumi.Input[builtins.str]] = None,
             state: Optional[pulumi.Input[builtins.str]] = None,
@@ -831,44 +489,16 @@ class WorkloadIdentityPool(pulumi.CustomResource):
                existing tokens to access resources. If the pool is re-enabled, existing tokens grant
                access again.
         :param pulumi.Input[builtins.str] display_name: A display name for the pool. Cannot exceed 32 characters.
-        :param pulumi.Input[Union['WorkloadIdentityPoolInlineCertificateIssuanceConfigArgs', 'WorkloadIdentityPoolInlineCertificateIssuanceConfigArgsDict']] inline_certificate_issuance_config: Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-               within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-               required for issuance and rotation of mTLS workload certificates.
-               Structure is documented below.
-        :param pulumi.Input[Union['WorkloadIdentityPoolInlineTrustConfigArgs', 'WorkloadIdentityPoolInlineTrustConfigArgsDict']] inline_trust_config: Represents config to add additional trusted trust domains. Defines configuration for extending
-               trust to additional trust domains. By establishing trust with another domain, the current
-               domain will recognize and accept certificates issued by entities within the trusted domains.
-               Note that a trust domain automatically trusts itself, eliminating the need for explicit
-               configuration.
-               Structure is documented below.
-        :param pulumi.Input[builtins.str] mode: The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-               are in `FEDERATION_ONLY` mode.
-               
-               > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-               `pulumi preview` may show an update if you change this field's value, `pulumi up`
-               **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-               To specify a different `mode`, please create a new Workload Identity Pool resource.
-               * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-               Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-               workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-               within the pool besides providers.
-               * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-               identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-               workload identifier. The subject identifier for all identities must conform to the following
-               format: `ns/<namespace>/sa/<workload_identifier>`.
-               `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-               mode pools.
-               Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
         :param pulumi.Input[builtins.str] name: The resource name of the pool as
                `projects/{project_number}/locations/global/workloadIdentityPools/{workload_identity_pool_id}`.
         :param pulumi.Input[builtins.str] project: The ID of the project in which the resource belongs.
                If it is not provided, the provider project is used.
         :param pulumi.Input[builtins.str] state: The state of the pool.
-               * `STATE_UNSPECIFIED`: State unspecified.
-               * `ACTIVE`: The pool is active, and may be used in Google Cloud policies.
-               * `DELETED`: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
+               * STATE_UNSPECIFIED: State unspecified.
+               * ACTIVE: The pool is active, and may be used in Google Cloud policies.
+               * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
                approximately 30 days. You can restore a soft-deleted pool using
-               `UndeleteWorkloadIdentityPool`. You cannot reuse the ID of a soft-deleted pool until it is
+               UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
                permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
                use existing tokens to access resources. If the pool is undeleted, existing tokens grant
                access again.
@@ -886,9 +516,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
         __props__.__dict__["description"] = description
         __props__.__dict__["disabled"] = disabled
         __props__.__dict__["display_name"] = display_name
-        __props__.__dict__["inline_certificate_issuance_config"] = inline_certificate_issuance_config
-        __props__.__dict__["inline_trust_config"] = inline_trust_config
-        __props__.__dict__["mode"] = mode
         __props__.__dict__["name"] = name
         __props__.__dict__["project"] = project
         __props__.__dict__["state"] = state
@@ -921,55 +548,6 @@ class WorkloadIdentityPool(pulumi.CustomResource):
         """
         return pulumi.get(self, "display_name")
 
-    @property
-    @pulumi.getter(name="inlineCertificateIssuanceConfig")
-    def inline_certificate_issuance_config(self) -> pulumi.Output[Optional['outputs.WorkloadIdentityPoolInlineCertificateIssuanceConfig']]:
-        """
-        Represents configuration for generating mutual TLS (mTLS) certificates for the identities
-        within this pool. Defines the Certificate Authority (CA) pool resources and configurations
-        required for issuance and rotation of mTLS workload certificates.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_certificate_issuance_config")
-
-    @property
-    @pulumi.getter(name="inlineTrustConfig")
-    def inline_trust_config(self) -> pulumi.Output[Optional['outputs.WorkloadIdentityPoolInlineTrustConfig']]:
-        """
-        Represents config to add additional trusted trust domains. Defines configuration for extending
-        trust to additional trust domains. By establishing trust with another domain, the current
-        domain will recognize and accept certificates issued by entities within the trusted domains.
-        Note that a trust domain automatically trusts itself, eliminating the need for explicit
-        configuration.
-        Structure is documented below.
-        """
-        return pulumi.get(self, "inline_trust_config")
-
-    @property
-    @pulumi.getter
-    def mode(self) -> pulumi.Output[Optional[builtins.str]]:
-        """
-        The mode for the pool is operating in. Pools with an unspecified mode will operate as if they
-        are in `FEDERATION_ONLY` mode.
-
-        > **Note** This field cannot be changed after the Workload Identity Pool is created. While
-        `pulumi preview` may show an update if you change this field's value, `pulumi up`
-        **will fail with an API error** (such as `Error 400: Attempted to update an immutable field.`).
-        To specify a different `mode`, please create a new Workload Identity Pool resource.
-        * `FEDERATION_ONLY`: Pools can only be used for federating external workload identities into
-        Google Cloud. Unless otherwise noted, no structure or format constraints are applied to
-        workload identities in a `FEDERATION_ONLY` mode pool, and you may not create any resources
-        within the pool besides providers.
-        * `TRUST_DOMAIN`: Pools can be used to assign identities to Google Cloud workloads. All
-        identities within a `TRUST_DOMAIN` mode pool must consist of a single namespace and individual
-        workload identifier. The subject identifier for all identities must conform to the following
-        format: `ns/<namespace>/sa/<workload_identifier>`.
-        `iam.WorkloadIdentityPoolProvider`s cannot be created within `TRUST_DOMAIN`
-        mode pools.
-        Possible values are: `FEDERATION_ONLY`, `TRUST_DOMAIN`.
-        """
-        return pulumi.get(self, "mode")
-
     @property
     @pulumi.getter
     def name(self) -> pulumi.Output[builtins.str]:
@@ -993,11 +571,11 @@ class WorkloadIdentityPool(pulumi.CustomResource):
     def state(self) -> pulumi.Output[builtins.str]:
         """
         The state of the pool.
-        * `STATE_UNSPECIFIED`: State unspecified.
-        * `ACTIVE`: The pool is active, and may be used in Google Cloud policies.
-        * `DELETED`: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
+        * STATE_UNSPECIFIED: State unspecified.
+        * ACTIVE: The pool is active, and may be used in Google Cloud policies.
+        * DELETED: The pool is soft-deleted. Soft-deleted pools are permanently deleted after
         approximately 30 days. You can restore a soft-deleted pool using
-        `UndeleteWorkloadIdentityPool`. You cannot reuse the ID of a soft-deleted pool until it is
+        UndeleteWorkloadIdentityPool. You cannot reuse the ID of a soft-deleted pool until it is
         permanently deleted. While a pool is deleted, you cannot use it to exchange tokens, or
         use existing tokens to access resources. If the pool is undeleted, existing tokens grant
         access again.